Privacy Policy

XAutoDM (the website at xautodm.com and the app at app.xautodm.com) is run by AmplifyX Tech (OPC) Private Limited. In this policy, "we" means that company and "you" means anyone who visits the site or uses the app.

Account details. Your email address, and your name and profile picture if you sign in with Google.

Your X account connection. This is the most sensitive thing we hold, so here is exactly how it works:

• If you connect by pasting cookies, we store your X session cookies (auth_token, ct0 and twid). They are encrypted with AES-256-GCM before they are saved, and they are only decrypted on our servers at the moment we perform an action you set up.
• If you connect with your X username and password, we use them once to log in and obtain a session. We do not store your password or your two-factor code.
• We store your X handle, display name and avatar so you can tell your connected accounts apart.

What you build in the app: lead lists, campaigns, message templates, follow-up steps, growth rules, your Do-Not-Contact list, notes and pipeline stages, and your settings (such as your booking link).

Your DM conversations. To show replies in the Reply Tracker and to stop a follow-up when someone answers, we read the DM conversations your campaigns started and keep a copy of recent messages in our database.

Billing details. Payments are handled by Lemon Squeezy, our merchant of record. We receive your plan, subscription status and billing email. We never see or store your card number.

Usage and device data. Pages you visit, buttons you click, approximate location from your IP address, browser and device type.

When you scrape or import leads, we collect public X profile data about them: name, handle, bio, follower and following counts, verification status and whether their DMs are open. You decide who to scrape and who to message. For that data, you are responsible for having a lawful reason to contact those people, and we process it on your behalf.

If someone you contacted asks us to delete their data, we will remove it from your lists and add them to your Do-Not-Contact list.

• To run the service: scrape the leads you ask for, send the DMs and follow-ups you schedule, run growth rules, and show you replies and analytics.
• To keep accounts safe: pacing, daily caps and pausing a campaign when something looks wrong.
• To bill you and to send service emails, such as receipts, failed payments, and a warning when your X account disconnects.
• To send product updates and tips. You can unsubscribe from these at any time (see section 7).
• To understand how the site and app are used, so we can fix what is confusing.

We do not sell your data, and we do not use your leads, messages or conversations to train AI models.

We only share data with companies that help us run XAutoDM, and only what each one needs:

• getxapi.com, our X integration provider. It receives your session cookies for each action we perform on X for you (a scrape, a DM, a follow).
• Supabase, our database and login provider (servers in Tokyo, Japan).
• Vercel and Netlify, which host the app and this website.
• Lemon Squeezy, for payments, tax and invoices.
• Brevo and Beehiiv, for service emails and our newsletter.
• Microsoft Azure OpenAI, for AI features such as the Reply Analyzer and our free writing tools, which receive only the text you submit to them.
• Google Analytics, Microsoft Clarity and the Meta Pixel on this website, to measure visits and ad performance.

We may also disclose data if the law requires it, or to a buyer if the business is ever sold, in which case this policy continues to apply.

We keep your data while your account is open. If you delete your account or ask us to, we delete your account data, connected X credentials, lead lists, campaigns and cached conversations within 30 days. Billing records are kept for as long as tax law requires.

Disconnecting an X account deletes its stored session cookies straight away.

When you create an account, or give us your email on this site, we add you to our product emails and newsletter. Every one of those emails has an unsubscribe link. Unsubscribing does not stop service emails about billing, security or your account.

This website uses cookies for analytics and advertising (Google Analytics, Clarity, Meta Pixel). The app uses cookies to keep you logged in. You can block or clear cookies in your browser; the app needs its login cookie to work.

You can ask us to show you the data we hold about you, correct it, export it, or delete it. Email xautodm@amplifyxlabs.com from the address on your account and we will reply within 30 days. Depending on where you live (for example under GDPR in the EU and UK, or India's Digital Personal Data Protection Act), you may also have the right to object to processing or to complain to your local data protection authority.

X session cookies are encrypted at rest. All traffic is encrypted in transit. Each user's data is separated in the database and every request is checked against the logged-in account. No system is perfectly secure, and if a breach affects your data we will tell you without undue delay.

XAutoDM is not meant for anyone under 18, and we do not knowingly collect data from children.

If we change this policy in a way that matters, such as adding a new type of data or a new provider that touches your data, we will update the date at the top and email account holders before the change takes effect.